Vulnerability-Lookup

OESA-2026-4469 (CVE-2026-88812)

Vulnerability from osv_openeuler – Published: 2026-10-22 14:35 – Updated: 2026-10-22 14:35 – Source website

Summary

xorg-x11-server security update

Details

X.Org X11 X server

Security Fix(es):

A flaw was found in the X.Org X Server and XWayland. An error handling issue in the X Keyboard Extension (XKB) geometry processing fails to clear a memory pointer after an allocation failure, leading to a double-free condition during cleanup. A local user can exploit this vulnerability by sending a specially crafted request to the display server. This can cause memory corruption, potentially resulting in a Denial of Service (DoS) or arbitrary code execution with elevated privileges. (From Red Hat.)(CVE-2026-88812)

A flaw was found in xorg-x11-server. A use-after-free vulnerability, where the application accesses memory after it has already been released, occurs in the Present extension because window notification entries are not properly unlinked before cleaning up window resources. An authenticated local X client can exploit this flaw by creating cross-window notifications and subsequently destroying the target window. Successful exploitation primarily results in a Denial of Service (DoS) via an X server crash, and may potentially lead to information disclosure.(CVE-2026-93515)

A flaw was found in xorg-x11-server. A local user can exploit a use-after-free condition—where the software attempts to access memory after it has been freed—by establishing a passive input grab and removing an input device. When subsequent input events are processed, the server dereferences the dangling device pointer. This flaw can lead to arbitrary code execution or a Denial of Service (DoS) via an X server crash.(CVE-2026-93516)

A flaw was found in xorg-x11-server. The GLX (OpenGL Extension to the X Window System) interface fails to verify that incoming data sizes do not exceed allocated buffer limits when handling large rendering requests. An authenticated local client can exploit this vulnerability by sending a specially crafted request, triggering a heap-based buffer overflow. Successful exploitation can result in arbitrary code execution with the privileges of the X server or cause a Denial of Service (DoS) by crashing the application. (From Red Hat.)(CVE-2026-93517)

A flaw was found in xorg-x11-server. Due to an integer truncation issue during memory allocation calculations within the X Keyboard Extension (XKB), the server allocates an undersized buffer when resizing key types. An authenticated local client can exploit this vulnerability by sending specially crafted XKB requests, causing a heap-based buffer overflow. This can result in arbitrary code execution or a denial of service (DoS). (From Red Hat.)(CVE-2026-93518)

Input_constrain_cursor() writes barrier events into a fixed-size buffer without checking bounds. When more than 100 pointer barriers are active, the writes overflow the fixed buffer on the stack or heap. An authenticated X client can trigger this by creating more than 100 pointer barriers (using the XFIXES extension) and then generating pointer motion events (e.g. via XTEST). Both extensions are enabled by default.(CVE-2026-93519)

A flaw was found in xorg-x11-server. In the X Keyboard Extension (XKB), key name memory is allocated with an insufficient buffer size compared to the maximum supported range. An authenticated local client can exploit this flaw by sending requests that modify the keycode range, triggering a heap-based buffer overflow. This vulnerability can lead to arbitrary code execution or cause a Denial of Service (DoS) by crashing the X server.(CVE-2026-93520)

A flaw was found in xorg-x11-server. The X server incorrectly calculates buffer sizes and memory offsets when prepending or appending data to RandR (Resize and Rotate extension) provider properties. A local attacker can exploit this vulnerability by sending specially crafted property update requests, causing memory corruption. This flaw could allow an attacker to escalate privileges or cause a denial of service (DoS) by crashing the X server.(CVE-2026-93521)

A flaw was found in xorg-x11-server. A local authenticated client can exploit this flaw by sending a crafted input device ungrab request with an unvalidated modifier value. This lack of validation causes the server to perform an out-of-bounds write on the heap, resulting in memory corruption that can lead to a denial of service (DoS) or potential arbitrary code execution.(CVE-2026-93523)

A flaw was found in xorg-x11-server. An authenticated local user can trigger an out-of-bounds heap memory read by sending specially crafted X Keyboard Extension (XKB) requests with inconsistent key range parameters. This flaw leads to information disclosure, allowing the user to read sensitive data from the server's heap memory.(CVE-2026-93524)

Severity

7.8 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-88812	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-93515	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-93516	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-93517	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-93518	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-93519	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-93520	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-93521	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-93523	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-93524	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "xorg-x11-server-1.20.11-49.oe2403sp1.aarch64.rpm",
          "xorg-x11-server-Xdmx-1.20.11-49.oe2403sp1.aarch64.rpm",
          "xorg-x11-server-Xephyr-1.20.11-49.oe2403sp1.aarch64.rpm",
          "xorg-x11-server-Xnest-1.20.11-49.oe2403sp1.aarch64.rpm",
          "xorg-x11-server-Xvfb-1.20.11-49.oe2403sp1.aarch64.rpm",
          "xorg-x11-server-common-1.20.11-49.oe2403sp1.aarch64.rpm",
          "xorg-x11-server-debuginfo-1.20.11-49.oe2403sp1.aarch64.rpm",
          "xorg-x11-server-debugsource-1.20.11-49.oe2403sp1.aarch64.rpm",
          "xorg-x11-server-devel-1.20.11-49.oe2403sp1.aarch64.rpm"
        ],
        "noarch": [
          "xorg-x11-server-help-1.20.11-49.oe2403sp1.noarch.rpm",
          "xorg-x11-server-source-1.20.11-49.oe2403sp1.noarch.rpm"
        ],
        "src": [
          "xorg-x11-server-1.20.11-49.oe2403sp1.src.rpm"
        ],
        "x86_64": [
          "xorg-x11-server-1.20.11-49.oe2403sp1.x86_64.rpm",
          "xorg-x11-server-Xdmx-1.20.11-49.oe2403sp1.x86_64.rpm",
          "xorg-x11-server-Xephyr-1.20.11-49.oe2403sp1.x86_64.rpm",
          "xorg-x11-server-Xnest-1.20.11-49.oe2403sp1.x86_64.rpm",
          "xorg-x11-server-Xvfb-1.20.11-49.oe2403sp1.x86_64.rpm",
          "xorg-x11-server-common-1.20.11-49.oe2403sp1.x86_64.rpm",
          "xorg-x11-server-debuginfo-1.20.11-49.oe2403sp1.x86_64.rpm",
          "xorg-x11-server-debugsource-1.20.11-49.oe2403sp1.x86_64.rpm",
          "xorg-x11-server-devel-1.20.11-49.oe2403sp1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP1",
        "name": "xorg-x11-server",
        "purl": "pkg:rpm/openEuler/xorg-x11-server\u0026distro=openEuler-24.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.20.11-49.oe2403sp1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "X.Org X11 X server\r\n\r\nSecurity Fix(es):\n\nA flaw was found in the X.Org X Server and XWayland. An error handling issue in the X Keyboard Extension (XKB) geometry processing fails to clear a memory pointer after an allocation failure, leading to a double-free condition during cleanup. A local user can exploit this vulnerability by sending a specially crafted request to the display server. This can cause memory corruption, potentially resulting in a Denial of Service (DoS) or arbitrary code execution with elevated privileges. (From Red Hat.)(CVE-2026-88812)\n\nA flaw was found in xorg-x11-server. A use-after-free vulnerability, where the application accesses memory after it has already been released, occurs in the Present extension because window notification entries are not properly unlinked before cleaning up window resources. An authenticated local X client can exploit this flaw by creating cross-window notifications and subsequently destroying the target window. Successful exploitation primarily results in a Denial of Service (DoS) via an X server crash, and may potentially lead to information disclosure.(CVE-2026-93515)\n\nA flaw was found in xorg-x11-server. A local user can exploit a use-after-free condition\u2014where the software attempts to access memory after it has been freed\u2014by establishing a passive input grab and removing an input device. When subsequent input events are processed, the server dereferences the dangling device pointer. This flaw can lead to arbitrary code execution or a Denial of Service (DoS) via an X server crash.(CVE-2026-93516)\n\nA flaw was found in xorg-x11-server. The GLX (OpenGL Extension to the X Window System) interface fails to verify that incoming data sizes do not exceed allocated buffer limits when handling large rendering requests. An authenticated local client can exploit this vulnerability by sending a specially crafted request, triggering a heap-based buffer overflow. Successful exploitation can result in arbitrary code execution with the privileges of the X server or cause a Denial of Service (DoS) by crashing the application. (From Red Hat.)(CVE-2026-93517)\n\nA flaw was found in xorg-x11-server. Due to an integer truncation issue during memory allocation calculations within the X Keyboard Extension (XKB), the server allocates an undersized buffer when resizing key types. An authenticated local client can exploit this vulnerability by sending specially crafted XKB requests, causing a heap-based buffer overflow. This can result in arbitrary code execution or a denial of service (DoS). (From Red Hat.)(CVE-2026-93518)\n\nInput_constrain_cursor() writes barrier events into a fixed-size buffer without checking bounds. When more than 100 pointer barriers are active, the writes overflow the fixed buffer on the stack or heap. An authenticated X client can trigger this by creating more than 100 pointer barriers (using the XFIXES extension) and then generating pointer motion events (e.g. via XTEST). Both extensions are enabled by default.(CVE-2026-93519)\n\nA flaw was found in xorg-x11-server. In the X Keyboard Extension (XKB), key name memory is allocated with an insufficient buffer size compared to the maximum supported range. An authenticated local client can exploit this flaw by sending requests that modify the keycode range, triggering a heap-based buffer overflow. This vulnerability can lead to arbitrary code execution or cause a Denial of Service (DoS) by crashing the X server.(CVE-2026-93520)\n\nA flaw was found in xorg-x11-server. The X server incorrectly calculates buffer sizes and memory offsets when prepending or appending data to RandR (Resize and Rotate extension) provider properties. A local attacker can exploit this vulnerability by sending specially crafted property update requests, causing memory corruption. This flaw could allow an attacker to escalate privileges or cause a denial of service (DoS) by crashing the X server.(CVE-2026-93521)\n\nA flaw was found in xorg-x11-server. A local authenticated client can exploit this flaw by sending a crafted input device ungrab request with an unvalidated modifier value. This lack of validation causes the server to perform an out-of-bounds write on the heap, resulting in memory corruption that can lead to a denial of service (DoS) or potential arbitrary code execution.(CVE-2026-93523)\n\nA flaw was found in xorg-x11-server. An authenticated local user can trigger an out-of-bounds heap memory read by sending specially crafted X Keyboard Extension (XKB) requests with inconsistent key range parameters. This flaw leads to information disclosure, allowing the user to read sensitive data from the server\u0026apos;s heap memory.(CVE-2026-93524)",
  "id": "OESA-2026-4469",
  "modified": "2026-10-22T14:35:31Z",
  "published": "2026-10-22T14:35:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4469"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88812"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93515"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93516"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93517"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93518"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93519"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93520"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93521"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93523"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93524"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "xorg-x11-server security update",
  "upstream": [
    "CVE-2026-88812",
    "CVE-2026-93515",
    "CVE-2026-93516",
    "CVE-2026-93517",
    "CVE-2026-93518",
    "CVE-2026-93519",
    "CVE-2026-93520",
    "CVE-2026-93521",
    "CVE-2026-93523",
    "CVE-2026-93524"
  ]
}

CVE-2026-88812 (GCVE-0-2026-88812)

Vulnerability from cvelistv5 – Published: 2026-10-27 17:43 – Updated: 2026-10-27 17:43

Title

X.Org Server XKB SetGeometry TextDoodad Double Free

Summary

A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a crash or potentially code in the x server context.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-415 - Double free

Assigner

suse CNA under the mitre root

CNA scorecard B 79/100 over 105 records in the last 180 days details

References

1 reference

URL	Tags
https://gitlab.freedesktop.org/xorg/xserver/-/com…	patch

Impacted products

2 products

Vendor	Product	Version
X.org	xorg-x11-server	Affected: 0 , < 21.1.25 (rpm) cpe:2.3:a:x.org:xorg-x11-server::::::::
x.org	xwayland	Affected: 0 , < 24.1.14 (rpm) cpe:2.3:a:x.org:xwayland::::::::

Date Public

2026-10-27 16:47

Credits

Anonymous with TrendAI Zero Day Initiative

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "xorg-x11-server",
          "product": "xorg-x11-server",
          "repo": "https://gitlab.freedesktop.org/xorg/xserver",
          "vendor": "X.org",
          "versions": [
            {
              "lessThan": "21.1.25",
              "status": "affected",
              "version": "0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "xwayland",
          "product": "xwayland",
          "repo": "https://gitlab.freedesktop.org/xorg/xserver",
          "vendor": "x.org",
          "versions": [
            {
              "lessThan": "24.1.14",
              "status": "affected",
              "version": "0",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:x.org:xorg-x11-server:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "21.1.25",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "24.1.14",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Anonymous with TrendAI Zero Day Initiative"
        }
      ],
      "datePublic": "2026-10-27T16:47:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A double free in\u0026nbsp;XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a crash or potentially code in the x server context."
            }
          ],
          "value": "A double free in\u00a0XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a crash or potentially code in the x server context."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-175",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-175 Code Inclusion"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-415",
              "description": "CWE-415 Double free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T17:43:18.583Z",
        "orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
        "shortName": "suse"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://gitlab.freedesktop.org/xorg/xserver/-/commit/0d1b1b0bad86c9ea2a3b7ca5a70e681dc69f1ecc"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "X.Org Server XKB SetGeometry TextDoodad Double Free",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
    "assignerShortName": "suse",
    "cveId": "CVE-2026-88812",
    "datePublished": "2026-10-27T17:43:18.583Z",
    "dateReserved": "2026-09-10T08:35:07.010Z",
    "dateUpdated": "2026-10-27T17:43:18.583Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted